WO2008019916A1 - Verfahren zur wiederaktivierung einer sicheren kommunikationsverbindung - Google Patents
Verfahren zur wiederaktivierung einer sicheren kommunikationsverbindung Download PDFInfo
- Publication number
- WO2008019916A1 WO2008019916A1 PCT/EP2007/057089 EP2007057089W WO2008019916A1 WO 2008019916 A1 WO2008019916 A1 WO 2008019916A1 EP 2007057089 W EP2007057089 W EP 2007057089W WO 2008019916 A1 WO2008019916 A1 WO 2008019916A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- server
- communication connection
- data packet
- client computers
- secure communication
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
Definitions
- the invention relates to a method for reactivating a secure communication connection between client computers and a server after a restart of the server, wherein secure communication links between the server and the client computers are provided for a transmission of data packets.
- Such services include, for example, the transmission of voice or data, especially in the form of packets.
- Communication networks such as Corporate networks or LANs, but also large networks such as the Internet, which are currently used mainly for the transmission of data - especially in packet form, due to their architecture - i. based on the conceptual structure of the communication network - be distinguished.
- host systems in which the users are connected via terminals or data terminals to a mostly powerful central or mainframe computer, or so-called peer-to-peer systems in which all computers or computers of the communication network are equal It also called client-server systems.
- a client-server system two types of computers are distinguished in the communication network - so-called servers and so-called clients or client computers.
- the server represents a network element or a computer in the communication network, from which centrally services - so said server applications or applications - for several other network elements or computers - the so-called clients or client computers - are offered.
- these server services are used and the user via user interface or user interface ⁇ Body of access to the central services of the server offered.
- the client computer establishes contact with the server.
- This principle is also referred to as a client-server principle.
- resources eg applications, databases, etc.
- Servers may be connected to the client computers via a local area network (e.g., corporate network, Local Area Network (LAN), etc.).
- a local area network e.g., corporate network, Local Area Network (LAN), etc.
- the access to the server from a client computer can also be done via telecommunications networks of various kinds such as the Internet, etc.
- the communication - i.e. the exchange of data - between the server and the client computers via a communication connection usually on the client-server principle.
- the term "communication connection” refers to a usable, through-connected physical line or even a so-called virtual path between fixed points of a communication network, such as server and client computer.
- protocols The rules governing the format and meaning of the messages and data exchanged over the communication link are referred to as protocols, which may be composed of several layers such as network, transport or application layer.
- the protocol used to exchange data and messages depends on the type or area of application of the server.
- servers that use the so-called HyperText Transfer Protocol (http) on the application layer to transfer data (eg websites, etc.) over a network (eg Internet) are also referred to as http servers.
- Other servers, from which protocols such as the File Transfer Protocol (FTP) are implemented as protocol at the application layer, for example, to transfer files from a server to a client computer, from a client computer to a server or client-controlled between two servers, can also generally be referred to as a file or data server.
- FTP File Transfer Protocol
- TCP Transmission Control Protocol
- FTP Fibre Transfer Protocol
- IP Internet Protocol
- Client-server system of which the Internet Protocol IP is used in communication links can also be referred to as IP-based client-server systems.
- a communication connection is also considered secure
- Communication connection referred to, if at least when establishing a communication connection between two computers (eg server and client computer) an authentication process is performed, which is ensured that the two computers are authorized to carry out this communication connection.
- an authentication process when establishing the secure communication connection, it can be determined whether the communication connection is also established with a correct communication partner - ie with that computer (eg server) to which, for example, data is to be transmitted.
- a communication partner eg computer, server, client computer, etc.
- a communication partner eg computer, server, client computer, etc.
- Communication links are protected, for example, from eavesdropping or unauthorized access to confidential data during transmission.
- the authentication process is additionally combined with an encryption process to protect against unauthorized access.
- an encryption process e.g.
- a scheme of request and response between the communication partners e.g, client computer, server, etc.
- each computer involved in the secure communication connection proves that a common encryption system exists and this computer thus participates the secure communication connection is authorized.
- common but secret digital certificates or keys are exchanged.
- IP networks Communication networks, of which the so-called Internet Protocol (IP) is used as the protocol at the network layer, are also referred to as IP networks. Since 1998, a separate security procedure has been developed for communication connections via these networks - the so-called IP Security (IPSec) protocol, which has meanwhile been defined by the Internet Engineering Task Force IETF in several Requests for Coments (RFC). The RFC 2401 from 1998 and the RFC 4301 from December 2005 - to say the main documents - describe the structure of IPSec.
- IP Internet Protocol
- RFC Requests for Coments
- IPSec is intended to ensure secure transmission of data in IP networks and thus protection goals such as confidentiality, authenticity and integrity. With IPSec the establishment of secure communication links, and thus a secure data transmission is possible.
- IPSec provides security services (eg access control, authentication procedure, confidentiality, etc.) which allow computers of an IP network to select security protocols for a secure communication connection and to determine algorithms for using the IPSec services and framework conditions for a definition of encryption parameters (eg key, key length, etc.), which are assumed by the IPSec services.
- security services eg access control, authentication procedure, confidentiality, etc.
- encryption parameters eg key, key length, etc.
- IP Authentication Header Mechanism which handles the authentication and identification of a data source. This mechanism is described by the IETF in RFC 2402 and RFC 4302, respectively.
- ESP Encapsulation Security Payload
- a database For managing which computers of a communication network or which addresses which are assigned to the respective computers and via which these computers can be addressed, IPSec with which parameters is to be used, a database, the so-called Security Policy Database SPD, is set up. In this database, all the necessary information is stored for the corresponding computers - separated by source and destination address when data is sent. When shipping data is then in the database
- SPD looked at how to deal with the data, there are basically three options: the data is to be discarded, that is, the address of the received Computer is locked; the data is forwarded unchanged or IPSec is to be used for the data.
- SA Security Association
- An SA usually only exists if data is exchanged more frequently between computers or their addresses. If this is not the case, an SA must be set up before the data exchange when establishing a secure communication connection. This can be done manually by setting via network management or using the International Security and Key Management Protocol (ISAKMP), which can also be referred to as the Internet Key Exchange (IKE) protocol.
- ISAKMP International Security and Key Management Protocol
- IKE Internet Key Exchange
- the ISAKMP or IKE protocol is defined in the RFCs 2408, 2409 and also 4306 of the IETF and is used in IP-based networks in which IPSec is used for managing
- ISAKMP or IKE is used before the actual protected data transmission with IPSec the authentication of sending and receiving computer as well as the negotiation of encryption methods or SAs between the computers, this being done in two phases.
- About a protected ⁇ transmission of the ISAKMP eg identification of a computer-applied encryption method, etc.
- a SA the so-called phasel SA.
- a SA the so-called phasel SA.
- the negotiated SAs of the first and the second phase may also, for example, during their period of validity Definition of a time period or a transferred amount of data for which SA is valid. After expiry of the validity period of an SA, a renewed authentication or a renewal of the encryption parameters is necessary, for example.
- Security specifications and / or encryption data (eg encryption methods, keys, key length, etc.), as they are exchanged, for example, in IPSec in the form of SAs between participating in a communication connection computers can also be invalid or discarded, if from one to a secure Communication connection participating computer a so-called reboot or restart is performed.
- the computer In a re-boot the computer is restarted - ie the so-called operating ⁇ system, of which, for example, resources of the computer such as memory, input / output devices, etc. are managed, the execution of programs is controlled, etc., is reloaded and, for example, tested and initialized essential components of the computer.
- a computer After a reboot, a computer usually only then processes corresponding for secure communication connections (for example, authentication, sending new
- Security specifications and / or encryption data, etc. go through to other computers when data is to be transferred to these computers again - this is also the case if these computers have already had secure communication connections before the reboot.
- IPSec for example, after a reboot, new Phasel SAs as well as new Phase2 SAs are only exchanged with another computer if the computer that has just carried out a ReBoot is to transfer the first data packet to this other computer. Has already existed before the re-boot a secure communication connection to this other computer and are therefore on this computer corresponding, from his point of view still valid SAs deposited, these are discarded and the newly exchanged SAs are used for further communication.
- the communication is usually triggered by the client computer, but not by the server. This means that when a client computer is re-booted, the processes for a secure communication connection are executed immediately upon the first contact with the server, but a reboot of the server leads to gaps in the communication when secure communication links are used, for example. using IPSec.
- the reboot is not recognized by a client computer from which data is sent over a secure communication link to the server. From the client computer, for example, continue to be replaced before the re-boot security requirements and / or
- Encryption data used for data transmission over the secure communication link Because of the reboot on the server, e.g. If the corresponding encryption data are no longer valid, the data transmitted by the secure communication connection can then be sent from server e.g. no longer recognized, decrypted or read. The data is therefore usually discarded by the server.
- Security specifications and / or encryption data, etc. are triggered for a secure communication connection, because, for example, expires the validity of the security defaults and / or encryption data stored on the client computer, communication between server and
- Identification of a computer, applied encryption ⁇ method, etc. can be defined, can be relatively long (eg up to 24 hours), thus long communication gaps may occur after re-booting a server. If the validity period of the phasel SA is, for example, the one transmitted
- this SA is no longer invalidated on the client computer side by a server reboot and therefore the processes for a secure communication connection can no longer be initiated by the client computer.
- Tunnel mode is used.
- status messages are regularly exchanged between the server and the client computer to determine whether the communication connection is still active. If no response is received during a timeout for the DPD message, the communication connection (eg IPSec tunnel) is closed until it is activated again by new data transmission.
- the DPD must be for their use, however be activated both at the server and at the client computer. Since DPD is currently not standardized, DPD is not implemented on all computer systems and therefore available. In addition, DPD also generates traffic and administrative data by regularly sending status messages.
- the present invention is therefore an object of the invention to provide a method by which in a simple way after a reboot or restart a server of this
- Server from processes for re-activation of a secure communication connection between server and client computers are started.
- the object is achieved by a method of the type mentioned above, wherein after restarting the server, a data packet is sent to the addresses of the client computer, being sent by the server based on the addresses of the client computer. Based on the addresses of the client computer is recognized by the server that for the
- Transmission of the data packet is provided a secure communication ⁇ connection, which has been interrupted by the restart of the server, and by sending this data packet processes for re-activation of the secure communication connections between the server and the client computers are triggered.
- the advantages achieved by the invention are in particular that a re-activation of the secure communication connections is triggered in a simple manner directly after the restart of the server, whereby any communication failures between server and client computer are kept short.
- a further advantage is that the secure communication connection between the server and client computers is already activated when the server is booted and thus the duration for the run-up is kept short.
- No additional administrative overhead is generated on the server.
- a preferred embodiment of the invention provides that the data packet from a so-called startup software, which is executed on the server between the expiration of operating system software and an application is shipped, the start-up software being part of the so-called
- Middelware software is the one that mediates between operating system software and applications, and therefore runs prior to launching an application. Therefore, a secure communication connection is advantageously already activated before the start of an application, from which a secure communication connection between the server and client computers is assumed, and the time duration for a run-up is thus kept short.
- the data packet is sent to all addresses of
- Client computers shipped for which a secure configuration connection has been configured on the server these addresses can be read for shipping the data packet, for example in IPSec from the so-called Internet Key Exchange Policy file.
- IPSec administrates those addresses of client computers to which a secure communication connection is to be established. Because this configuration data already on the server are present, therefore, no additional administrative effort for the dispatch of the data packet for re ⁇ activation of a secure communication connection is necessary.
- the data packet is sent to the addresses of those client computers for which a valid, secure communication connection was provided until restarting, ideally these addresses from the server, for example, before restarting or when establishing a secure communication connection to this client computer for the first time can be saved in a file.
- This variant of the method according to the invention is particularly useful if in the configuration of the addresses for secure
- UDP User Datagram Protocol
- UDP User Datagram Protocol
- TCP transport layer protocol
- the data packet according to UDP protocol as a destination port number, a comparatively high port number such as the port number 33434, etc. is sent. For example, because the high port numbers are not used by applications and are therefore unused, this will
- UDP packet when received by a client computer, usually ignored. However, the UDP packet nevertheless triggers the processes for reactivating the secure communication connection, since these processes are only started by sending them to the server.
- SAs shared security associations
- Protocol and for each port number own SAs generated. Because shared SAs avoid generation of additional data on the server or client computers, shared SAs are commonly used.
- FIG. 1 schematically shows the sequence of the method according to the invention for reactivating a secure communication connection.
- the method according to the invention is described by way of example for an IP-based client-server system, of which IPSec is used as a security method. However, the method according to the invention is also applicable to other (non-IP-based) client-server systems or when using other security methods for communication connections.
- the method begins with a starting step 1.
- a reboot of a server of an IP-based client-server system, from which secure communication links IPSec is used, is performed.
- the re-boat are all deactivated active secure communication connections on the side of the server - ie the existing Phasel for this communication ⁇ connections and Phase2 Security Associations lose their validity by the re-boot on the server or are discarded on the server.
- addresses of client computers are read from the server from a file for sending the UDP data packet. For example, at
- IPSec a so-called IKE policy file or data stored in the Security Policy Database SPD be used if, for example, the UDP data packet to all client computers for which a secure communication connection has been configured on the server to be sent. If the UDP data packet will only be sent to each client computer has to those before restarting actually a safe, active communication ⁇ connection existed, the addresses of these client computers can be stored on the server in a separate file and this file is then for shipping of the UDP data packet.
- the server determines in a fifth method step 5 that the transmission of the UDP data packet to this client computer must be carried out via a secure communication connection.
- the server becomes, for example, IPSec a Phasel Security
- a seventh method step 7 the new phase SA, which has been set up by the server, is recognized by the corresponding client computers.
- the client computers then discard any remaining SAs for secure communications with the server and use the new Phasel SA.
- a new Phase2 SA is set up by the server with the client computers, in which e.g. the encryption of the data to be transmitted is determined.
- the client computers then use the new Phase2 SA.
- a secure communication connection to a client computer in a ninth step 9 is activated again.
- the UDP data packet can then be transmitted in encrypted form to the respective client computer in accordance with the security method used and its mechanisms (eg IPSec).
- the UDP data packet for example, a high port number such as port number 33434 registered as a destination port number, since it is irrelevant whether the UDP data packet is actually received by the client computers. If the UDP data packet is received by a client computer, it is, for example, ignored or discarded because of the high port number, and client computers, for example, send a response to the server that the destination port number can not be reached.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP07787363A EP2055074A1 (de) | 2006-08-17 | 2007-07-11 | Verfahren zur wiederaktivierung einer sicheren kommunikationsverbindung |
US12/377,800 US20100293369A1 (en) | 2006-08-17 | 2007-07-11 | Method for reactivation of a secure communication link |
CA2661053A CA2661053C (en) | 2006-08-17 | 2007-07-11 | Method for reactivation of a secure communication link |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
DE102006038599A DE102006038599B3 (de) | 2006-08-17 | 2006-08-17 | Verfahren zur Wiederaktivierung einer sicheren Kommunikationsverbindung |
DE102006038599.3 | 2006-08-17 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2008019916A1 true WO2008019916A1 (de) | 2008-02-21 |
Family
ID=38646110
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/EP2007/057089 WO2008019916A1 (de) | 2006-08-17 | 2007-07-11 | Verfahren zur wiederaktivierung einer sicheren kommunikationsverbindung |
Country Status (6)
Country | Link |
---|---|
US (1) | US20100293369A1 (de) |
EP (1) | EP2055074A1 (de) |
CN (1) | CN101529857A (de) |
CA (1) | CA2661053C (de) |
DE (1) | DE102006038599B3 (de) |
WO (1) | WO2008019916A1 (de) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP5351158B2 (ja) * | 2007-07-23 | 2013-11-27 | インタートラスト テクノロジーズ コーポレイション | テザード装置システム及び方法 |
US8788804B2 (en) * | 2008-05-15 | 2014-07-22 | Qualcomm Incorporated | Context aware security |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5734810A (en) * | 1994-07-06 | 1998-03-31 | Hitachi, Ltd. | Client server system performing automatic reconnection and control method thereof |
US20030204769A1 (en) * | 2002-04-30 | 2003-10-30 | Coughlin Chesley B. | Session error recovery |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7213063B2 (en) * | 2000-01-18 | 2007-05-01 | Lucent Technologies Inc. | Method, apparatus and system for maintaining connections between computers using connection-oriented protocols |
GB2366631B (en) * | 2000-03-04 | 2004-10-20 | Ericsson Telefon Ab L M | Communication node, communication network and method of recovering from a temporary failure of a node |
US6999992B1 (en) * | 2000-10-04 | 2006-02-14 | Microsoft Corporation | Efficiently sending event notifications over a computer network |
US7302479B2 (en) * | 2002-07-23 | 2007-11-27 | International Business Machines Corporation | Dynamic client/server session recovery in a heterogenous computer network |
US7676838B2 (en) * | 2004-07-26 | 2010-03-09 | Alcatel Lucent | Secure communication methods and systems |
-
2006
- 2006-08-17 DE DE102006038599A patent/DE102006038599B3/de not_active Expired - Fee Related
-
2007
- 2007-07-11 CN CNA200780038915XA patent/CN101529857A/zh active Pending
- 2007-07-11 EP EP07787363A patent/EP2055074A1/de not_active Withdrawn
- 2007-07-11 WO PCT/EP2007/057089 patent/WO2008019916A1/de active Application Filing
- 2007-07-11 CA CA2661053A patent/CA2661053C/en not_active Expired - Fee Related
- 2007-07-11 US US12/377,800 patent/US20100293369A1/en not_active Abandoned
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5734810A (en) * | 1994-07-06 | 1998-03-31 | Hitachi, Ltd. | Client server system performing automatic reconnection and control method thereof |
US20030204769A1 (en) * | 2002-04-30 | 2003-10-30 | Coughlin Chesley B. | Session error recovery |
Also Published As
Publication number | Publication date |
---|---|
DE102006038599B3 (de) | 2008-04-17 |
CA2661053C (en) | 2012-04-03 |
EP2055074A1 (de) | 2009-05-06 |
US20100293369A1 (en) | 2010-11-18 |
CA2661053A1 (en) | 2008-02-21 |
CN101529857A (zh) | 2009-09-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
DE602004007301T2 (de) | Adressierungs-verfahren und -vorrichtung zum aufbau von hip-verbindungen zwischen gewöhnlichen und hip-fähigen netzknoten | |
DE60215117T2 (de) | Mehrbenutzeranwendungen in multimedia-netzwerken | |
DE60200451T2 (de) | Herstellung einer gesicherten Verbindung mit einem privaten Unternehmensnetz über ein öffentliches Netz | |
DE60218042T2 (de) | Verfahren und system für einen dienstleistungsprozess zur bereitstellung eines dienstes zu einem kunden | |
DE69831974T2 (de) | Verfahren zur paketauthentifizierung in gegenwart von netzwerkadressübersetzungen und protokollumwandlungen | |
DE60209475T2 (de) | Datensicherungs-kommunikationsvorrichtung und -verfahren | |
DE102014113582B4 (de) | Vorrichtung, Verfahren und System für die kontextbewusste Sicherheitssteuerung in einer Cloud-Umgebung | |
EP1289227B1 (de) | Verfahren, System und Rechner zum Aushandeln einer Sicherheitsbeziehung auf der Anwendungsschicht | |
DE60201522T2 (de) | Ermöglichen legales abfangen von ip-verbindungen | |
DE69918026T2 (de) | Gesicherte "keep alive" Nachricht über das Internet | |
WO2011091887A1 (de) | Verfahren zum gesicherten download von verteilten downloadsourcen | |
WO2019145207A1 (de) | Verfahren und system zur offenlegung mindestens eines kryptographischen schlüssels | |
EP2014010B1 (de) | Verfahren, vorrichtungen und computerprogrammprodukt zum ver- und entschlüsseln von mediendaten | |
EP3970337A1 (de) | Verfahren zum selektiven ausführen eines containers und netzwerkanordnung | |
DE102006038599B3 (de) | Verfahren zur Wiederaktivierung einer sicheren Kommunikationsverbindung | |
WO2007113073A1 (de) | Verfahren zum wiederherstellen einer mit ipsec kryptographisch gesicherten verbindung zwischen p-cscf und anwendereinheit | |
EP1126677A2 (de) | Schutz von sicherheitskritischen Daten in Netzwerken | |
EP1776821B1 (de) | System und verfahren zum sicheren anmelden in einem kommuniktionssystem mit netzwerkverbindungs- und verbindungssteuerungs-rechnern | |
DE10107883B4 (de) | Verfahren zur Übertragung von Daten, Proxy-Server und Datenübertragungssystem | |
EP2773081A1 (de) | Kommunikationsgerät für ein industrielles Kommunikationsnetz und ein Verfahren zur Bereitstellung von Daten, insbesondere Dateien, in einem industriellen Kommunikationsnetz mittels File Transfer Protocol | |
EP1496665B1 (de) | Verfahren zur Festlegung von Sicherheitseinstellungen in einem Automatisierungsnetz | |
WO2000019678A2 (de) | Anordnung und verfahren zur codierung und decodierung digitaler daten nach dem internet protokoll | |
EP1929741B1 (de) | Zugangselement und verfahren zur zugangskontrolle eines netzelements | |
DE10332470B4 (de) | Verfahren und Vorrichtung zur Kommunikation zwischen Anwendungssystemen in unterschiedlichen Unternehmensnetzwerken | |
EP1052802B1 (de) | Verfahren zur Kopplung von NetBIOS Netzwerken und Rechnern |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WWE | Wipo information: entry into national phase |
Ref document number: 200780038915.X Country of ref document: CN |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 07787363 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2007787363 Country of ref document: EP |
|
ENP | Entry into the national phase |
Ref document number: 2661053 Country of ref document: CA |
|
WWE | Wipo information: entry into national phase |
Ref document number: 12377800 Country of ref document: US |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
NENP | Non-entry into the national phase |
Ref country code: RU |